CoolCMS API

JwtPayload
in package

FinalYes
Attributes
#[Schema]
$schema: 'JwtPayload'
$title: 'JwtPayload'
$description: 'Obsah JWT access tokenu — identita přihlášeného uživatele.'
$properties: [new \OpenApi\Attributes\Property(property: 'userId', type: 'integer', example: 13), new \OpenApi\Attributes\Property(property: 'role', type: 'string', example: 'user'), new \OpenApi\Attributes\Property(property: 'username', type: 'string', example: 'test')]

Table of Contents

Properties

$capabilities  : array<int, JwtCapability>
Capability claim, see {@see JwtCapability}; empty for most tokens, and a token that carries one has `userId = 0`.
$role  : string
$userId  : int
$username  : string

Methods

__construct()  : mixed
fromArray()  : self
Tolerantly builds the payload from decoded token data.
getCapabilities()  : array<int, JwtCapability>
getRole()  : string
getUserId()  : int
Returns the user id, where `0` means "no identity".
getUsername()  : string
setRole()  : self
setUserId()  : self
setUsername()  : self
toArray()  : array<string, int|array<int, array<string, int|string>>|string>
Serializes the payload for the token.
withCapabilities()  : self

Properties

$capabilities

Capability claim, see {@see JwtCapability}; empty for most tokens, and a token that carries one has `userId = 0`.

private array<int, JwtCapability> $capabilities = []

Methods

__construct()

public __construct([int $userId = 0 ][, string $role = '' ][, string $username = '' ][, array<string|int, mixed> $capabilities = [] ]) : mixed
Parameters
$userId : int = 0
$role : string = ''

informational comma-separated role names at login time (see LoginUser::login())

IMPORTANT: $role is not a source of authority and nothing may decide permissions from it. A refresh family lives up to 60 days, and a role removal must apply at once, so authorization always reads fresh rights from the DB on every request. The field stays only to keep the token shape; removing it would break old tokens for no benefit.

$username : string = ''
$capabilities : array<string|int, mixed> = []

fromArray()

Tolerantly builds the payload from decoded token data.

public static fromArray(array<string|int, mixed> $data) : self

IMPORTANT: reading must stay tolerant for every key. Live sessions hold tokens in the old shape, and a missing or null key under strict_types would throw a TypeError, which JwtManager::decodeToken() (catch (\Exception)) does not catch, so the request would die with a fatal error. A missing caps gives []; a broken single capability is dropped and the rest of the token stays valid.

NOTE: JwtManager::decodeToken() passes (array) $decoded->data, so nested items are stdClass, not arrays; JwtCapability::fromValue() normalizes them.

Parameters
$data : array<string|int, mixed>
Return values
self

getRole()

public getRole() : string
Return values
string

getUserId()

Returns the user id, where `0` means "no identity".

public getUserId() : int

NOTE: the type stays int with default 0 and is deliberately not nullable. A nullable type would not fix the flaw (fromArray() can still read userId: 0 from a token) and would change the return type for every caller; the edge belongs in PermissionResolver, which translates 0 itself.

Return values
int

getUsername()

public getUsername() : string
Return values
string

setRole()

public setRole(string $role) : self
Parameters
$role : string
Return values
self

setUserId()

public setUserId(int $userId) : self
Parameters
$userId : int
Return values
self

setUsername()

public setUsername(string $username) : self
Parameters
$username : string
Return values
self

toArray()

Serializes the payload for the token.

public toArray() : array<string, int|array<int, array<string, int|string>>|string>

NOTE: the caps key is emitted only when non-empty, so an ordinary login token keeps the shape of earlier versions; AuthStorageTrait::createIdentity() still reads only userId and username.

Return values
array<string, int|array<int, array<string, int|string>>|string>
On this page

Search results